How to List Users and Groups in Ubuntu Using Command Line

If you’ve been working with Ubuntu for any length of time, you’ve likely encountered situations where you need to list users and groups in Ubuntu, check which user accounts exist on the system, or find out which groups a specific user belongs to.

Maybe you’re onboarding a new team member and need to grant them access to a specific directory. Maybe you’re debugging a permission error and can’t understand why a user can’t reach a file they should have access to. Or maybe you’re inheriting a server from someone else and need to audit who’s on it.

That’s exactly what we’re covering today. This guide walks you through everything you need to know about listing users and groups in Ubuntu using the command line. We’ll look at the files that store this information, the commands that query them, and some practical scenarios where this knowledge actually matters.

TL;DR

• Ubuntu stores user data in /etc/passwd and group data in /etc/group
• Use getent passwd or cat /etc/passwd to list all users
• Use getent group or cat /etc/group to list all groups
• The id command shows a user’s UID, GID, and group memberships in one shot
• The who and w commands reveal who’s currently logged into your system
• Group membership determines what files and resources a user can access

Understanding How Ubuntu Tracks Users and Groups

Before we dive into commands, it helps to understand the underlying system. Ubuntu, like most Linux distributions, stores account information in plain-text files that live in the /etc directory.

For additional guidance on managing Ubuntu accounts and permissions, refer to the official Ubuntu user-management documentation.

The three key files are:

• /etc/passwd : holds user account information
• /etc/shadow : stores password hashes and password-aging information. It is normally accessible only to the root user or privileged system processes.
• /etc/group : stores group definitions

You can open and read all three of these files right now. They follow a predictable format, and once you understand that format, you’ll have much more control over how Ubuntu manages access to your system.

How Ubuntu Defines a User Account

Every user on an Ubuntu system has a corresponding line in /etc/passwd.

Here’s an example of a typical entry:

LOGINNAME:x:1001:1001:FULLNAME,,,:/home/DIRECTORY:/bin/bash

LOGINNAME:x:1001:1001:FULLNAME,,,:/home/DIRECTORY:/bin/bash

That’s one line. Let me break it down field by field:

The UID (User ID) is what Ubuntu actually uses internally to track users, not the username.

Root always has UID 0. System services get UIDs in the 1–999 range typically, while regular users start from 1000 onwards.

The GID (Group ID) tells you which primary group the user belongs to. But here’s something that trips up many beginners: a user can belong to multiple groups. The primary group is just the one that’s assigned by default when creating files.

How to List All Users in Ubuntu

There are several ways to pull a user list. I’ll show you the most practical approaches, from quick one-liners to more targeted queries.

If you are unsure which release is installed on your server or desktop, first check your Ubuntu version using the command line or GUI.

The Straightforward Approach: cat /etc/passwd

The most direct method is simply reading the passwd file:

cat /etc/passwd

cat /etc/passwd

This dumps every user account on the system. System accounts, service accounts, regular users , all of them.

The output is readable, but it includes a lot of system users you’ll probably never interact with (things like daemon, nobody, www-data). For a cleaner view focused only on human users, you might want to filter by UID range:

awk -F: '$3 >= 1000 && $3 != 65534 { print $1 }' /etc/passwd

awk -F: '$3 >= 1000 && $3 != 65534 { print $1 }' /etc/passwd

This prints only usernames where the UID is 1000 or higher, which is the pattern for regular user accounts on Ubuntu.

The Query Command: getent passwd

getent queries the system’s Name Service Switch (NSS) databases, which means it pulls from the same sources as system lookups, including LDAP if your organization uses it. It’s more comprehensive than directly reading /etc/passwd in environments with multiple authentication backends.

getent passwd

getent passwd

The output looks identical to cat /etc/passwd, but the underlying mechanism is different. In most standalone Ubuntu systems, they’ll produce the same results. In networked environments, getent is the more reliable choice.

This is particularly useful when Ubuntu is configured to retrieve identities from LDAP or another centralized directory service.

Pulling Just the Usernames: awk

If you only need usernames, not the full account details, you can extract just the first field:

getent passwd | awk -F: '{ print $1 }'

getent passwd | awk -F: '{ print $1 }'

As shown below:

Or equivalently:

awk -F: '{ print $1 }' /etc/passwd

awk -F: '{ print $1 }' /etc/passwd

As shown below:

this is useful when you’re piping the output into another command, like checking if a specific user exists:

getent passwd | awk -F: '{ print $1 }' | grep -w "USERNAME"

getent passwd | awk -F: '{ print $1 }' | grep -w "USERNAME"

As shown below:

Finding a Specific User

To check whether a particular user exists and see their full record:

getent passwd username

getent passwd username

Replace username with whatever you’re looking for. If the user exists, you’ll get their full passwd line. If not, you’ll get no output.

Checking Who Has Root Access

A quick audit to see which users can run sudo commands:

getent group sudo

getent group sudo

Or

getent group root

getent group root

However, this does not indicate who has root privileges. The root group is simply the primary group associated with the root account.

How to List All Groups in Ubuntu

Groups in Ubuntu work as logical containers for users. Instead of managing permissions one user at a time, you assign permissions to a group and add or remove users from it. This makes bulk permission changes much simpler.

Group information lives in /etc/group. Each line follows this format:

group_name:password_marker:GID:member1,member2,...

group_name:password_marker:GID:member1,member2,...

Here’s a real example:

sudo:x:27:USERNAME,adminuser

sudo:x:27:USERNAME,adminuser

• sudo : the group name
• x : password marker (usually ignored; permissions come from group membership)
• 27 : the GID
• USERNAME,adminuser : users who belong to this group

Listing Groups with cat /etc/group

The simplest approach:

cat /etc/group

cat /etc/group

This shows every group on the system, including ones you probably didn’t know existed (like video, audio, bluetooth).

Listing Groups with getent group

For the same reason as with user accounts, getent is preferable in environments with multiple authentication sources:

getent group

getent group

As shown below:

Extracting Just Group Names

Need just the group names, one per line?

cut -d: -f1 /etc/group

cut -d: -f1 /etc/group

As shown below:

Or:

getent group | cut -d: -f1

getent group | cut -d: -f1

As shown below:

Checking a Specific Group’s Members

To see who belongs to a particular group:

getent group groupname

getent group groupname

For example:

getent group sudo

getent group sudo

As shown below:

This tells you exactly which users can perform administrative tasks on your system. It’s one of the first things I check when auditing a new server.

Checking a User’s Groups with the id Command

The id command is probably the most useful single command in this entire guide. Give it a username, and it tells you that user’s UID, primary GID, and all supplementary group memberships in one clean output.

id

id

As shown below:

Running id without arguments shows information about the current user. Running it with a username shows that user’s details:

id USERNAME

id USERNAME

Typical output looks like:

uid=1001(USERID) gid=1001(GROUPID) groups=1001(USERNAME),27(sudo),1002(developers),1003(project-alpha)

uid=1001(USERID) gid=1001(GROUPID) groups=1001(USERNAME),27(sudo),1002(developers),1003(project-alpha)

As shown below:

This tells you immediately:

• UID: 1001
• Primary GID: 1001 (the USERNAME group)
• Other groups: sudo (administrative access), developers, project-alpha

If you’re debugging a permission problem, this is usually the first command I run. It takes two seconds and gives you everything you need to understand what a user can actually access.

The groups Command

Running groups without an argument displays the groups of the current user:

groups

groups

As shown below:

To check the groups of another user, specify the username:

groups username

groups username

As shown below:

The output is simpler than id because it lists group names without displaying the user’s UID or GID.

Who’s Currently Logged In?

Sometimes you need to know who’s on the system right now, not just what accounts exist. That’s what who and w are for.

The who Command

who

who

Shows which users are currently logged in, along with their terminal, login time, and (if applicable) their remote IP address. Clean and simple.

Sample output:

username  tty2    2026-07-30 08:45
admin   pts/0   2026-07-30 09:12    192.168.1.50

username  tty2    2026-07-30 08:45
admin   pts/0   2026-07-30 09:12    192.168.1.50

As shown below:

The w Command

w

w

The w command provides more detail than who, including:

• Users currently logged in
• System uptime and load averages
• Login time and idle time
• JCPU and PCPU usage
• The command each user is currently running

This is particularly useful on shared servers where you want to see if someone’s running something resource-intensive.

Quick Reference Table

Common Scenarios Where This Comes Up

Here are a few real situations where knowing these commands actually matters:

1. Permission Errors When Accessing Files: You created a file in /var/www/html , but your web server can’t read it. Running id www-data tells the web server user belongs to which groups. Running ls -la on the file shows you who owns it and what permissions are set. From there, it’s usually obvious what’s wrong.

2. Adding a User to a Project Group: A new team member joins and needs access to the analytics directory. You add them to the analytics group with usermod -aG analytics username, and suddenly they can access the files. This only works if the files are owned by that group and have group-read or group-write permissions set.

If the required user or group does not exist yet, Ubuntu provides the adduser and addgroup utilities for creating and managing them.

3. Auditing a Shared Server: You inherited a VPS with five other people’s accounts on it and no documentation. Running getent passwd | awk -F: '$3 >= 1000 { print $1 }' gives you a clean list of human users. Cross-referencing that with sudo getent group sudo tells you who has admin access. Within two minutes, you have a full picture.

4. Verifying SSH Key Deployment: If you’ve set up key-based SSH authentication, the who command shows you who’s actively connected. This helps confirm that deployments are working and users are getting access as expected.

If a user cannot connect to the server, follow our guide to troubleshoot the SSH Connection Refused error.

Security Considerations Worth Keeping in Mind

A few things I always keep in mind when working with user and group management:

1. System accounts are off-limits. The www-data, nobody, daemon accounts exist to run services. Don’t modify them, don’t add files to their home directories, and don’t grant them sudo access unless you have an extremely specific reason.

2. UID 0 (root) is the nuclear option. Any account with UID 0 has unrestricted access to the system. The only default account with UID 0 is root. If you see additional accounts with UID 0, that’s a serious security red flag.

3. The sudo group is your primary admin group. On Ubuntu, this is how most users get elevated privileges. Keep track of who belongs to it. Regularly auditing this group takes thirty seconds and could prevent a lot of problems.

4. Group permissions inherit down. When a user creates a new file, that file gets assigned their primary GID. If you want files created in a shared directory to be accessible to the whole team, you need to set the directory’s setgid bit, otherwise each file will be locked to the creator’s group only.

Key Takeaways

• Ubuntu stores user data in /etc/passwd and group data in /etc/group, both human-readable files
• getent passwd and getent group are the most reliable commands for listing users and groups
• The id command is the quickest way to see a user’s UID, GID, and all group memberships at once
• who and w tell you who’s actively logged in, not just what accounts exist
• Regular users typically have UIDs starting at 1000; system services use 1–999
• Group membership controls file access, understanding it is essential for debugging permission issues
• Regularly auditing sudo group membership is a basic but important security practice

Conclusion

Understanding how to list and audit users and groups in Ubuntu is a fundamental system administration skill that helps with security, troubleshooting, and user management. Whether you’re debugging a permission error, onboarding a new team member, or doing a security audit on an unfamiliar server, the commands in this guide will get you there quickly.

The good news: Ubuntu makes this information readily accessible. You don’t need special tools or root access for most of what we covered. Open a terminal, run a command, and you have answers.

Practice these commands until they become second nature, especially id, getent, and who. They’ll save you time and frustration more often than you’d expect.

FAQs

About the Author

Meghna Meghwani is a technical writer focused on Linux, Ubuntu, VPS hosting, server management, WordPress, PHP, Node.js, cloud hosting, and DevOps. She creates beginner-friendly tutorials, practical hosting guides, troubleshooting articles, and server security content designed to help developers and businesses manage applications and servers more efficiently.